CVE-2021-21619: XSS vulnerability in Jenkins Claim Plugin
Summary
CVE-2021-21619: XSS vulnerability in Jenkins Claim Plugin. Affects org.jenkins-ci.plugins:claim versions < 2.18.2. Fixed in 2.18.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Claim Plugin is a Maven package (org.jenkins-ci.plugins:claim) that allows users to claim ownership of builds and tests in the Jenkins continuous integration and delivery system. It provides a way for users to assert their involvement in specific jobs or tasks. The plugin displays the user's display name in claims. However, versions 2.18.1 and earlier do not properly escape the user display name, leading to a cross-site scripting (XSS) vulnerability. This vulnerability can be exploited by attackers who can control the display names of Jenkins users, either through the security realm or directly within Jenkins. Users with a Jenkins account can change their own display names. The vulnerability has a CVSS score of 8.0 (High).
Vulnerability Detail
The XSS vulnerability in the Jenkins Claim Plugin (CVE-2021-21619) arises from the plugin's failure to escape the user display name shown in claims. This allows attackers who can control the display names of Jenkins users to inject malicious scripts into the user interface. By exploiting this vulnerability, an attacker can execute arbitrary code within the context of the affected user's browser. This can lead to various consequences, including unauthorized access to sensitive information, session hijacking, and further attacks against other users. The vulnerability affects versions 2.18.1 and earlier of the Claim Plugin.
How To Fix
Minimum fixed version
2.18.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, users can mitigate the risk by ensuring that user display names do not contain any untrusted or potentially malicious content. Administrators can enforce display name restrictions through the security realm configuration or by implementing custom validation logic within Jenkins. For example, regular expressions can be used to validate and sanitize display names, removing any potentially dangerous characters or scripts.
Conclusion
The XSS vulnerability in the Jenkins Claim Plugin (CVE-2021-21619) allows attackers to execute arbitrary code within the affected user's browser. This can lead to unauthorized access, session hijacking, and further attacks. Users should upgrade to version 2.18.2 or later of the plugin to fix the vulnerability. If immediate upgrade is not possible, administrators should enforce display name restrictions to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:claim →
FAQ
The vulnerability allows attackers to execute arbitrary code within the context of the affected user's browser. This can lead to unauthorized access to sensitive information, session hijacking, and further attacks against other users.
All users of Jenkins who have the Claim Plugin version 2.18.1 or earlier installed are affected by this vulnerability.
Yes, attackers can exploit this vulnerability remotely by manipulating the display names of Jenkins users, either through the security realm or directly within Jenkins.
A workaround is to ensure that user display names do not contain any untrusted or potentially malicious content. Administrators can enforce display name restrictions through the security realm configuration or by implementing custom validation logic within Jenkins.
Yes, the vulnerability has been fixed in version 2.18.2 of the Jenkins Claim Plugin. Users are advised to upgrade to this version to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:claim.
